logging in/out; uses cookies and session; better form handling, validation